1. Field of the Invention
The invention pertains to the field of integrated circuits. More particularly, the invention pertains to radiation hardening of integrated circuit devices.
2. The Prior Art
CMOS integrated circuits are well known in the art and are used in thousands of different applications. It is also well known in the art that CMOS integrated circuits are vulnerable to a variety of radiation effects that make them unsuitable or unreliable for a variety of uses in the aerospace, space, and military fields without a degree of radiation hardening appropriate for the particular radiation environment anticipated for the application.
Some radiation effects like, for example, total ionizing dose, relate to physical damage sustained by the semiconductor structures due to charged particle impacts and are beyond the scope of this disclosure. Other classes of radiation effects like, for example, Single Event Effects (SEE), apply to logic errors induced during normal operation. As transistor feature sizes have scaled down, their critical charges for SEE have scaled down as well. As a consequence, SEE could affect both the sequential and combinational logic. In the case of sequential logic they are called Single Event Upsets (SEU), and in the case of combinational logic they are called Single Event Transients (SET).
When a charged particle strikes the semiconductor substrate in a CMOS integrated circuit during normal operation, it ionizes atoms along its trajectory, leaving a temporary surplus of charge carriers (hole and electron pairs) in its wake. If the particle passes through a first doped semiconductor region that is being driven to a voltage that is different than the voltage of a second surrounding and oppositely doped semiconductor region, the surplus carriers distort the normal shape of the depletion region separating (and usually electrically isolating) the two oppositely doped regions and current begins to flow in the direction of the electric field generated by the voltage difference between the two doped regions. This effect is known as a “Field Funnel.” If the first doped region is a node in a logic circuit, the practical effect of a field funnel is to inject a substantial amount of extra charge onto the node that drives it towards the opposite logical state from where it should be. The driver driving the logic node will supply current to counteract the field funnel current, though its degree of success will depend on its ability to supply current, the circuit topology, and the amount of charge available in the funnel. The funnel will persist until all of its carriers have drifted onto the logic node or have diffused away and recombined in the second semiconductor region.
If the logic node is part of a feedback path, as in a sequential element such as a latch or flip/flop, then the driver driving the logic node must succeed in restoring the voltage on the logic node to the correct logic level before the radiation induced incorrect signal can propagate all the way around the feedback path or the wrong data will remain stored in the sequential element. This would be an example of an SEU. There are a variety of methods known in the art to mitigate SEUs. One way is to make the node drivers large enough so that the particle strike either does not cause a significant amount of voltage variation or the driver can source or sink enough current to restore the struck node to its original voltage value before the incorrect signal propagates around the feedback loop. Unfortunately, this typically requires drivers to be far larger than the minimum or near-minimum sized transistors that are desirable to use in logic circuits.
A second SEU mitigation technique is the so-called dice-cell that extends the basic latch feedback loop from two inverters to four stages of series PMOS and NMOS transistors while coupling the PMOS and NMOS gates to successive outputs in opposite directions around the loop. This prevents a particle strike from upsetting more than two of the four nodes in the cell and allows the cell to return to its correct stable state once the field funnel charge has been exhausted. An example of this approach can be found in FIG. 1 of U.S. Pat. No. 6,573,773 to Maki, et al.
A third common technique is Triple Module Redundancy (TMR). This approach is to build the same identical circuit (or module—the technique can be applied to any level of component in a system) three times and then comparing the three outputs by means of voting logic. If this is done for a single bit of sequential logic, the three outputs are connected to the inputs of a voting gate (sometimes known as a majority-of-three gate or MAJ3 gate or M3 gate where MAJ3(A,B,C)=M3(A,B,C)=AB+AC+BC in Boolean algebra) that produces an output in agreement with any two of the three inputs if the third input has a different logic value and an output in agreement with all three inputs if all have the same logic value.
A fourth technique, used in cases where a wide data word comprising multiple bits is employed, is to encode the data before storage with an error correction code (ECC) and then decode it before use. This is a very common approach in volatile memories like static random access memories (SRAMs) where the cost of the ECC circuits can be amortized over many bits.
Typically when SEE mitigation is attempted in the prior art, SEU mitigation is addressed first and then sometimes SET mitigation is attempted. A number of SET mitigation techniques are known in the art. FIG. 1 shows an analog guard gate 100 of the prior art. Typically guard gates are used to filter out SET pulses occurring on one of two different, nominally equivalent versions of a logic signal. The nominally equivalent versions of a logic signal (called “SET domains”) are either generated by a duplication of the logic or by delaying the signal in time by some means. In either case, the logical value of the different versions will be identical except either immediately after a legitimate change in logic state or immediately after an SET. When inputs A and B are at the same logic state, guard gate 100 acts like a logical buffer. When inputs A and B are both at logic-1, the output of the first stage node C drives to logic-0 and the output of the second stage the node Y drives to logic-1. When inputs A and B are both at logic-0, node C drives to logic-1 and the output Y drives to logic-0. When inputs A and B are at different values (logic-0/1 or logic 1/0), one of the P-channel transistors 102 and 104 and one of the N-channel transistors 106 and 108 will be turned off presenting high impedance to the node C. The latch comprising inverters 110 and 112 will hold the last value on node Y until the transient has passed and inputs A and B are equal again. Thus when inputs A and B are coupled to nominally equivalent logic signals in two different SET domains like, for example, coupling A and B to either end of a delay element (not shown) or to the outputs of duplicated logic functions (not shown), the guard gate 100 will not respond to an SET induced transition on only one of the inputs A or B.
FIG. 2 shows a prior art digital guard gate 200. The basic operation is similar to the analog guard gate 100 of FIG. 1. This is the equivalent to a majority-of-3 or MAJ3 or voting gate with the output fed back and connected to one of the three inputs, in this case Y(A,B,Y)=AB+AY+BY. Here, if A=B=1 then Y=1; if A=B=0 then Y=0; and if A≠B then Y=Y. In other words, the output node Y is driven to the same logic state as inputs A and B when they are identical. When A and B are not identical, Y retains its previous value (by voting with the input of the same value to retain its state). Guard gate 200 could be substituted for guard gate 100 in many applications.
FIG. 3 shows a guard gate 302 similar to the guard gate 100 of FIG. 1 (transistors 102, 104, 106 and 108) with an RS-latch (NAND-gates 308 and 310) replacing the two inverter latch (inverters 110 and 112) in a configuration 300 used to measure the pulse widths of SET events. Guard gate 302 is combined with variable delay 304 to form an SET filter. The input of the SET filter is coupled to a target circuit 306, in this case a delay line 306 with its input coupled to ground (or logic-0). The output of the guard gate 302 is coupled to the RS-latch formed by NAND-gates 308 and 310. Driving the RESET signal to logic-0 forces the value logic-0 at the output node OUT, then RESET is returned to its normal value of logic-1. While the circuit waits for an SET to occur (typically in a particle beam inside a test chamber), nodes A and B are at logic-0, the node C is at logic-1, and the output node Y is at logic-0.
When the target 306 is struck by a particle of sufficient energy, a transient logic-1 may appear on node A. If the transient logic-1 on node A persists for longer than it takes for the variable delay 304 to propagate the logic-1 to node B, then guard gate 302 will output a logic-0 on node Y causing the RS-latch to transition to logic-1 where it will stay until a controller (not shown) notes the presence of the logic-1, logs it, and then resets the RS-latch to wait for another SET to occur.
Since the particle density and particle energy of the beam are known, by tabulating the number of SETs during a known test time as well as changing the value of the variable delay 304 from test to test, a great deal can be learned about the radiation performance of the target circuit 306. Of particular importance is correlating the widths of SET pulses with the energy of the particles generating them by experimentally varying the length of the variable delay 304 and the composition of the particle beam.
FIG. 4A shows a signal delay type SET filter of the prior art used in a configuration 400 for mitigating SET in an application specific integrated circuit (ASIC) logic design. Sequential elements 402 and 410 are latches or flip/flops (FFs) forming the beginning and end of a logical stage while logic circuit 404 forms the core of the logic stage. In a test design, logic circuit 404 would typically be a delay line with a single input and a single output (as shown), while in a logic design, logic circuit 406 typically would perform a number of Boolean functions and would have multiple inputs (not shown) and often have multiple outputs (not shown). If present, the multiple inputs and outputs would need to be radiation hardened in the same or similar manner. Delay element 406 and guard gate 408 form an SET filter with its input coupled to the logic circuit 404 and its output coupled to sequential element 410. The circuit 400 filters out SET induced pulses created in the logic circuit 404 that are narrower than the length of the delay element 406.
It is assumed that the sequential element is mitigated in some way such as triple module redundancy (TMR) or dice cell or equivalent. Either guard gate 100 of FIG. 1 or guard gate 200 of FIG. 2 could be used as guard gate 408.
FIG. 4B shows a logic duplication type SET filter of the prior art used in a configuration 450 for mitigating SET in an application specific integrated circuit (ASIC) logic design. Sequential elements 452 and 458 are latches or flip/flops forming the beginning and end of a logical stage while nominally equivalent logic circuits 454a and 454b form the core of the logic stage. In a test design, logic circuits 454a and 454b would typically be delay lines with a single input and a single output (as shown), while in a logic design, logic circuits 454a and 454b typically would perform a number of Boolean functions and would have multiple inputs (not shown) and often multiple outputs (not shown). If present, the multiple inputs and outputs would need to be radiation hardened in the same or similar manner. Guard gate 456 forms an SET filter with its inputs coupled to the nominally equivalent outputs of logic circuits 454a and 454b and its output coupled to sequential element 458. The circuit 450 filters out SET induced pulses created in either one or the other of the logic circuits 454a and 454b. It is assumed that the sequential element is mitigated in some way such as triple module redundancy (TMR) or dice cell or equivalent. Either guard gate 100 of FIG. 1 or guard gate 200 of FIG. 2 could be used as guard gate 456.
FIG. 5 shows an SEU mitigated sequential element 500 of the prior art that is suitable for use in the circuits 400 and 450 in FIGS. 4A and 4B respectively. This is a TMR circuit, where the sequential elements (either flip/flops or latches) 502, 504 and 506 are tripled in parallel and then the three outputs are resolved by voting gate (or VG) 508. If a charged particle upsets the contents of one of the sequential elements, the voting gate 508 will filter out the anomalous result and present the correct value stored in the other two sequential elements to the circuit output 510. To be most effective, sequential elements 502, 504 and 506 must be physically separated by more than a distance known as the “double strike” distance. This will prevent a charged particle impacting the integrated circuit at a shallow angle relative to the surface from upsetting more than one of the latches at any given time. The chances of two sequential elements in SEU mitigated sequential element 500 being upset by two different charged particles is sufficiently small to be of no practical significance, so preventing a single particle from creating two SEUs in two related sequential elements is sufficient for virtually all purposes.
The primary weakness of the SEU mitigated element 500 of FIG. 5, and by extension the prior art SET filters 400 and 450 of FIGS. 4A and 4B respectively, is that the signal generated in the logic (404 in FIGS. 4A and 454a/454b in FIG. 4B) is reduced to a single wire between the SET filter and the SEU mitigated sequential element. This makes the circuit vulnerable to a particle strike in either the guard gate (408 in FIGS. 4A and 456 in FIG. 4B) or in the input stage of one of the flip/flops (502, 504 or 506 in FIG. 5). In a custom design this can be addressed by hardening the guard gate (408 in FIGS. 4A and 456 in FIG. 4B), although this can consume considerable silicon area per guard gate. In an ASIC utilizing a standard cell library or a PLD utilizing logic modules, the logic function for the guard gate will be typically be available (or can be built from other library elements), but is most likely not available in a hardened version. Thus the need for an improved solution exists, particularly in hardening a design in a commercial ASIC or PLD for use in a radiation environment.
In general, if hardening is incorporated into a CMOS integrated circuit's sequential logic, SET can become the primary source of observable SEE. On application specific integrated circuits (ASICs) and non-volatile programmable logic devices (PLDs), two commonly used types of logic integrated circuits, SET effects can be “transient” if not captured by a memory cell. This is also true for volatile (SRAM based) PLDs, but the issue of hardening the memory elements containing the programming data against SEUs must be separately addressed. While the SET filtering techniques described herein are applicable to all CMOS integrated circuits, programmable or not, they are of particular interest to PLDs because they provide an extremely convenient measurement and experimentation vehicle for the investigation of radiation effects due to their programmable nature.
A PLD comprises a programmable logic block with any number of initially uncommitted logic modules arranged in an array along with an appropriate amount of initially uncommitted routing resources. Logic modules are circuits that can be configured to perform a variety of logic functions like, for example, AND-gates, OR-gates, NAND-gates, NOR-gates, XOR-gates, XNOR-gates, inverters, multiplexers, adders, latches, and flip/flops. Routing resources can include a mix of components such as wires, switches, multiplexers, and buffers. Logic modules, routing resources, and other features like, for example, I/O buffers and memory blocks, are the programmable elements of the PLD.
The programmable elements have associated control elements (sometimes known as programming bits or configuration bits) that determine their functionality. The control elements may be thought of as binary bits having values such as on/off, conductive/non-conductive, true/false, or logic-1/logic-0 depending on the context. The control elements vary according to the technology employed and their mode of data storage may be either volatile or non-volatile. Volatile control elements, such as SRAM bits, lose their programming data when the PLD power supply is disconnected, disabled or turned off. Non-volatile control elements, such as antifuses and floating gate transistors, do not lose their programming data when the PLD power supply is removed. Some control elements, such as antifuses, can be programmed only one time and cannot be erased. Other control elements, such as SRAM bits and floating gate transistors, can have their programming data erased and may be reprogrammed many times. The detailed circuit implementation of the logic modules and routing resources can vary greatly and is appropriate for the type of control element used.
Like most integrated circuits, PLDs typically have an input/output (I/O) ring surrounding a central core, though other approaches are possible. The I/O ring contains the input and output buffers that interface to circuits external to the PLD as well as the power supply and ground connections. Some of the input and output buffers are typically dedicated to control functions. Others are programmable elements that can be part of an end user's complete design. It is common for the programmable element inputs and outputs (also called user inputs or user input buffers and user outputs or user output buffers) to pair equal numbers of input buffers and output buffers together to form input/output buffers (also called I/O buffers or user I/O buffers or user I/Os or sometimes simply I/Os). In some PLDs, one or more of the inputs, outputs, or I/Os can be shared between user design functions and control functions.
In a pure PLD, the central core contains a programmable logic block comprising the majority of the programmable elements and control elements. The programmable logic block also typically contains a variety of control circuits. There may be other control circuits present either inside the central core or inside the I/O ring or divided between the central core and the I/O ring. This control circuitry handles various tasks such as testing the PLD functionality, programming the control elements, or transitioning the PLD from one mode of operation to another. In a hybrid PLD, there are typically other function blocks available to the user during normal operation such as central processing units, digital signal processors, custom logic blocks, and large volatile or non-volatile memory blocks. In some cases, the programmable logic block may be a minority of the total central core circuitry.
An end user's PLD design is typically implemented by use of a computer program product (also known as software or, more specifically, design software) produced by the PLD manufacturer and distributed by means of a computer-readable medium such as providing a CD-ROM to the end user or making the design software downloadable over the internet. Typically the manufacturer supplies a library of design elements (also known as library elements) as part of the computer program product. The library design elements provide a layer of insulation between the end user and the circuit details of the programmable elements, control elements, and the other PLD features available to the end user. This makes the design software easier to use for the end user and simplifies the manufacturer's task of processing the end user's complete design by the various tools in the design software.